Quick Reference Guide. Good for Enterprise to BlackBerry Work using BlackBerry UEM Transition Guide

Transcription

1 Quick Reference Guide Good for Enterprise to BlackBerry Work using BlackBerry UEM Transition Guide

2 Published: SWD

3 Contents Good for Enterprise to BlackBerry Work transition guide... 4 Key concepts... 4 Installation requirements... 5 Steps to transition from Good for Enterprise to BlackBerry Work...5 Create a BlackBerry Dynamics profile... 6 BlackBerry Dynamics profile settings... 7 Make BlackBerry Work available to users...10 Update the app list Configure BlackBerry Work app settings...11 BlackBerry Work app configuration settings Configure BlackBerry Work connection settings...20 Creating and managing user groups Creating directory-linked groups Create a local group...23 Assign the BlackBerry Dynamics profile to a user group...25 Assign an app to a user group...25 Connect Good Mobile Control to BlackBerry UEM...26 Steps to migrate users Remove the GFE MDM profile on ios devices Migrate from Good for Enterprise to BlackBerry Work Decommissioning Good for Enterprise...28 Legal notice...30

4 Good for Enterprise to BlackBerry Work transition guide 1 This document explains how to plan a transition from Good for Enterprise to BlackBerry Work. Key concepts Product BlackBerry Dynamics BlackBerry Enterprise Mobility Server BlackBerry UEM With the exception of Good for Enterprise, all BlackBerry Dynamics apps now run on the BlackBerry Dynamics platform. ISV and custom enterprise apps are also built on the BlackBerry Dynamics platform. BlackBerry Enterprise Mobility Server is an application middleware server platform that provides various mobile backend services (MBaaS) from enterprise backends such as Microsoft Exchange, Microsoft Lync, and Microsoft SharePoint. These services are used by BlackBerry Work, other BlackBerry Dynamics apps, and ISV apps built with the BlackBerry Dynamics SDK. The BlackBerry Enterprise Mobility Server delivers these as standardized backend services around push notifications, directory lookups, online presence, and more. BlackBerry UEM is a multiplatform EMM solution that provides comprehensive device, app, and content management with integrated security and connectivity. With BlackBerry UEM you can: Manage BlackBerry 10, ios, OS X, Android (including devices that use Samsung KNOX), Windows (including Windows 10 tablets and computers), and BlackBerry OS (version 5.0 to 7.1) devices Use a simple web-based interface to manage BYOD, COPE, and COBO devices and protect business information Manage complex fleets of devices using comprehensive reporting and dashboards, dynamic filters, and robust search capabilities Keep mobile workers connected with the information that they need 4

5 Installation requirements Refer to the requirements for the environment that you are installing. Product BlackBerry UEM 12.7 Maintenance Release 1 or later BlackBerry Enterprise Mobility Server See the BlackBerry UEM Planning content and the BlackBerry UEM Installation and Upgrade content. Your environment may require the advanced services that a BlackBerry Enterprise Mobility Server installation provides to BlackBerry Work and other BlackBerry Dynamics apps. For example, you may require Push Registration, BlackBerry Presence, BlackBerry Directory Lookup, and BlackBerry Docs. For comprehensive guidance on installing BlackBerry Enterprise Mobility Server and deploying the services necessary to support BlackBerry Work and any other BlackBerry Dynamics apps that you intend to deploy, see the BlackBerry Enterprise Mobility Server Installation and Configuration content. Steps to transition from Good for Enterprise to BlackBerry Work Step Action Install BlackBerry UEM. Install the BlackBerry Enterprise Mobility Server. Create a BlackBerry Dynamics profile or update the Default BlackBerry Dynamics profile. Make BlackBerry Work available to users. Configure BlackBerry Work app settings Configure BlackBerry Work connection settings Create a user group and assign the following to it: 5

6 Step Action BlackBerry Dynamics profile BlackBerry Work and any other apps that you want to assign to users Connect Good Mobile Control to BlackBerry UEM. Instruct users to activate their devices, install BlackBerry Work, and remove Good for Enterprise. Decommission Good for Enterprise. Create a BlackBerry Dynamics profile The BlackBerry Dynamics profile enables BlackBerry Dynamics for users and allows devices to use BlackBerry Dynamics apps, such as BlackBerry Work, BlackBerry Access, and BlackBerry Connect. BlackBerry UEM includes a Default BlackBerry Dynamics profile with preconfigured settings. If no BlackBerry Dynamics profile is assigned to a user account, a user group that a user belongs to, or a device group that a user's devices belong to, BlackBerry UEM sends the Default BlackBerry Dynamics profile to a user's devices. BlackBerry UEM automatically sends a BlackBerry Dynamics profile to a device when a user activates it, when you update an assigned BlackBerry Dynamics profile, or when a different BlackBerry Dynamics profile is assigned to a user account or device. You can assign the BlackBerry Dynamics profile to user accounts, user groups, or device groups. Note: If you have upgraded from BES12 version 12.4 or 12.5, have an existing BlackBerry Dynamics environment, and have not synchronized this environment with BlackBerry UEM, the BlackBerry Dynamics profile will contain only the settings available in BES12 version 12.4 or You must synchronize Good Control with BlackBerry UEM to see the updated profile. For more information about synchronizing Good Control with BlackBerry UEM, see Getting Started with BlackBerry UEM and BlackBerry Dynamics. 1. In the BlackBerry UEM management console, on the menu bar, click Policies and Profiles. 2. Click beside BlackBerrry Dynamics. 3. Type a name and description for the profile. 4. Click the tab for each device type in your organization and configure the appropriate values for each profile setting. 5. Select Enable UEM Client to enroll in BlackBerry Dynamics to allow the BlackBerry UEM Client to manage the activation of BlackBerry Dynamics so users do not have to use access keys to activate their BlackBerry Dynamics apps. 6. For more information about each profile setting, see BlackBerry Dynamics profile settings. 7. Click Add. 6

7 BlackBerry Dynamics profile settings BlackBerry Dynamics profile setting Configuration Enable UEM Client to enroll in BlackBerry Dynamics Require device management to use BlackBerry Dynamics apps When this setting is selected, the BlackBerry UEM Client manages the activation of BlackBerry Dynamics apps. Users do not have to use access keys to activate them. If you do not plan to use BlackBerry Dynamics in your environment, do not select this option. This setting specifies whether a device must be activated with MDM to use BlackBerry Dynamics apps. Password Password expiration Do not allow previous passwords Minimum password length Allowed occurrences of a character Require both letters and numbers Require both uppercase and lowercase Require at least one special character Do not allow sequences of more than two numbers Do not allow more than one password change per day Do not allow personal information This setting specifies whether the password for a BlackBerry Dynamics app expires and how long a password remains valid before it expires. This setting specifies whether previous passwords can be used and the maximum number of previous passwords that cannot be used for a BlackBerry Dynamics app. This setting specifies the minimum length of the password for a BlackBerry Dynamics app. This setting specifies how many times a character can appear in a password for a BlackBerry Dynamics app. This setting specifies whether the password must contain both letters and numbers for a BlackBerry Dynamics app. This setting specifies whether the password must contain both uppercase and lowercase letters for a BlackBerry Dynamics app. This setting specifies whether the password must contain at least one special character for a BlackBerry Dynamics app. This setting specifies whether the password can contain more than two sequential numbers (for example,1, 2, 3) for a BlackBerry Dynamics app. This setting specifies whether a password can be changed more than once every 24 hours for a BlackBerry Dynamics app. This setting specifies whether the following personal information can be used in a password for a BlackBerry Dynamics app: 7

8 BlackBerry Dynamics profile setting The user's first and last names (excluding initials) as recorded in Active Directory. The part of an address before sign. Allow Touch ID Do not require a user password for ios Do not require a user password for Android This setting specifies whether fblackberry Dynamics apps can be started using Touch ID when they are already open in the app switcher on ios devices. This setting specifies whether a user is required to set a password for BlackBerry Dynamics apps. When selected, a user does not have to enter a password to open and use the app. This setting specifies whether a user is required to set a password for BlackBerry Dynamics apps. When selected, a user does not have to enter a password to open and use the app. Lock screen Require password when BlackBerry Dynamics apps start Require password after period of inactivity Take action after invalid password attempts This setting specifies whether a password is required each time a BlackBerry Dynamics app is started. Note: If you are using authentication delegation, do not select this option. This setting specifies the period of inactivity that must elapse before a password is required. This setting specifies whether there is a limit to the number of times that a user can enter an incorrect password. If you select this rule, specify the number of times that a user can enter an incorrect password and the action that occurs after the limit has been reached. Choose one of the following actions: Lock out user Wipe Data Wearables Allow wearables This setting specifies whether BlackBerry Dynamics apps can be used on a wearable device. If you select this rule, specify the how much time must elapse before the wearable device is disconnected and whether the wearable can reconnect automatically. App authentication delegation You can select up to three apps to act as the authentication delegate on behalf of other apps so that users do not have to create a password for each BlackBerry Dynamics app that they install. After an authentication delegate is configured, each time a user opens a BlackBerry Dynamics app, the device displays the password screen for the authentication delegate instead of the app that they are attempting to open. After the user enters the password for the authentication delegate, the user can open the BlackBerry Dynamics app. 8

9 BlackBerry Dynamics profile setting You can choose any app to be the authentication delegate for other apps, but it is recommended that you choose your most commonly used app to be the primary authentication delegate to provide the most seamless experience for the user. Data leakage prevention Do not allow copying data from non BlackBerry Dynamics apps into BlackBerry Dynamics apps Do not allow copying data from BlackBerry Dynamics apps into non BlackBerry Dynamics apps Do not allow Android dictation Do not allow screen captures on Android devices Do not allow ios dictation Do not allow custom keyboards Enable FIPS This setting specifies whether users can copy data from non BlackBerry Dynamics apps to BlackBerry Dynamics apps. This setting specifies whether users can copy data from BlackBerry Dynamics apps to non BlackBerry Dynamics apps. This setting specifies whether Android device users can use voice dictation with BlackBerry Dynamics apps. This setting specifies whether Android device users can take screen captures in BlackBerry Dynamics apps. This setting specifies whether ios device users can use voice dictation with BlackBerry Dynamics apps. This setting specifies whether ios device users can use custom keyboards with BlackBerry Dynamics apps. This setting specifies whether compliance with U.S. Federal Information Processing standard is enforced. Certificates Enable device certificate store This setting specifies whether BlackBerry Dynamics apps can get certificates from the device certificate store. Detailed logging Enable detailed logging for BlackBerry Dynamics apps Prevent users from turning on detailed logging in BlackBerry Dynamics apps This setting specifies whether log files can be generated and uploaded from BlackBerry Dynamics apps. This setting specifies whether users can turn on the ability to generate and share detailed log files from BlackBerry Dynamics apps. 9

10 BlackBerry Dynamics profile setting Agreement Enable an agreement message for BlackBerry Dynamics apps This setting specifies whether to display a message in BlackBerry Dynamics apps that the user must acknowledge. If authentication delegation is enabled, the message is displayed only in the authenticator app. If you select this rule, complete the following actions: Specify if the message is displayed each time the app is unlocked, otherwise the message is only displayed the first time the user opens the app. In the Message field, create the message that you want to display. Note: On Android devices, only the first 4000 characters are displayed. Make BlackBerry Work available to users To manage BlackBerry Work in BlackBerry UEM, you must add BlackBerry Work to the app list. To add BlackBerry Work to the app list in BlackBerry UEM, your organization must be entitled to use BlackBerry Work in the BlackBerry Marketplace for Enterprise Apps. After your organization is entitled to use the app, you can update the app list to synchronize BlackBerry Work with BlackBerry UEM right away or wait until it synchronizes automatically. BlackBerry UEM synchronizes BlackBerry Dynamics apps every 24 hours. After the apps have been added to the app list, they can be assigned to users. For a complete description of how to manage BlackBerry Dynamics apps in BlackBerry UEM, see Getting Started with BlackBerry UEM and BlackBerry Dynamics. 1. Log in to your account at 2. Locate the app in the BlackBerry Marketplace for Enterprise Apps and request a trial. The app will be made available to your organization and can be assigned to users after the app has been synchronized to BlackBerry UEM. 3. To purchase the app, contact your sales representative or your channel partner sales representative. After you finish: Update the app list. To allow users to install and activate BlackBerry Work on their devices, assign BlackBerry Work to a user group. Update the app list 1. On the menu bar, click Apps. 2. Click. 10

11 Configure BlackBerry Work app settings You must add your Exchange ActiveSync server information and, optionally, configure other settings. 1. On the menu bar, click Apps. 2. Click the BlackBerry Work app. 3. On the BlackBerry Dynamics tab, in the App configuration table, click Type a name for the app configuration. 5. On the Exchange Settings tab, configure the following settings: a. In the Default Domain field, specify the default Windows NT Domain that BlackBerry Work will automatically attempt to connect to when users log in to BlackBerry Work. If your server uses the newer UPN ( @host.com) style login instead of the older (domain\user) style login, leave this field blank. b. In the Active Sync Server field, specify the default Exchange ActiveSync server that BlackBerry Work will attempt to connect to when users log in to BlackBerry Work (for example, cas.mydomain.com). c. In the Auto Discover URL field, specify the auto discover URL if known. This will speed up the auto discover setup process (for example, d. In the Auto Discover Connection Timeout in Seconds (ios only) field, specify the auto discover connection timeout in seconds. 6. Optionally, configure any other settings. See BlackBerry Work app configuration settings for a description of all of the settings that you can configure. 7. Click Save. BlackBerry Work app configuration settings App Settings tab Autodiscover If you select this option, BlackBerry Work automatically discovers the Exchange ActiveSync server. Note: Due to possible security vulnerabilities, it is not recommended that you select this option. Authorized Domains If you select this option, a warning is displayed in BlackBerry Work when a user attempts to share information outside of the trusted domains list specified in the Authorized domains field. You can edit the sample text displayed in the warning message field. 11

12 App Settings tab External Marking Avatar Photos Presence Service Search Diagnostics BlackBerry Gatekeeping Service If you select this option, subject lines of messages sent outside of the user's domain are prepended with the text specified in the Text to prepend field. If you select this option, contact photographs are displayed in BlackBerry Work. If this option is not selected, the user's initials are displayed instead of a photograph. If you select this option, users can see the online status of their Microsoft Lync contacts. If you select this option, users can search messages on the server. If you select this option, users can perform app diagnostics from the BlackBerry Dynamics Launcher on their devices. If you select this option, unauthorized devices are prevented from using Exchange ActiveSync unless they are explicitly added to the allowed list using the BlackBerry Gatekeeping Service. To use the BlackBerry Gatekeeping Service, you must create a gatekeeping configuration for the Microsoft Exchange Server or Microsoft Office 365 and assign an profile to users that has the automatic gatekeeping server selected. For details on how to configure the BlackBerry Gatekeeping Service, see Controlling which devices can access Exchange ActiveSync. Notifications tab Select level of detail in notifications Select level of detail in Calendar notifications Select the level of detail that users see in notifications. Select the level of detail that users see in calendar notifications. Select the Show only generic notifications when app is locked (Android only) option to show only generic information in notifications if the app is locked. Select the Show notifications on connected wearable devices (Android Wear only) option to display notifications on Android Wear devices. Select the Show Work Calendar lock-screen widget (ios only) options to allow the work calendar widget to be accessed from the lock screen of ios 10 and later devices. Additional options for notifications on Android Wear devices Select whether there are additional notifications for Android Wear devices. 12

13 Notifications tab Apple Watch App ios App Icon Badge Select whether to allow BlackBerry Work on Apple Watch devices. Note that BlackBerry Work on Apple Watch does not use the BlackBerry Dynamics secure container. Select this option to allow users to choose between displaying a badge count for unread and new messages as their default badge count on the app icon. If this option is not selected, the app icon badge will reflect the number of new messages that were received since the user last closed the app, and the user cannot select Unread Mails as a badge count preference. S/MIME tab Enhanced Security Sending Select the Periodically require PIN entry to access SMIME capabilities option if you want users to be required to periodically enter a PIN to use S/MIME. In the Default signing algorithm drop-down list, select the algorithm to use for signing sent messages. In the Default encryption algorithm, select the encryption algorithm to use. Select whether s must be signed and encrypted. Receiving In the Automatically download the body of S/MIME s drop-down list, select how the body of S/MIME messages is downloaded. Wi-Fi is supported on Android devices only. If you select this option, ios devices are set to "Never." Select the Perform name checking (verify address in certificate matches user's account) option to perform name checking. Name checking verifies that the address in the certificate matches user's account. Certificate Management Revocation Checking when the OCSP server is available Specify when to clear the public certificate cache. Select the Enable revocation checking option to enable revocation checks and specify the depth of certificate checking. Select the Use AIA extension in certificate if present option to use the AIA extension in certificates if present. In the Default OCSP URL field, specify the default OCSP URL to use if the AIA extension cannot be used or it is not present in a certificate. 13

14 Address Book tab Address Book Sync Select the Allow syncing BlackBerry Contacts to device option to synchronize contacts to devices and choose the fields that are synchronized. In the Maximum length for notes field field, specify the maximum length for the notes field. Select the Even if icloud is enabled, allow syncing BlackBerry Contacts to device option to allow synchronization to occur when icloud is enabled. GAL Search Recipients Specify the maximum number of results to display when searching the global address list (GAL). Specify whether caching is enabled. When caching is enabled, the cache is used to offer autocomplete suggestions for recipients during composition. Interoperability Camera and Device Photo Gallery permissions Voice SMS Misc Launch 3rd Party App Specify whether to allow access to the device camera, the photo gallery, or both. Specify whether to allow users to use the native phone app on a device or VOIP apps. Specify whether to allow users to initiate their native SMS apps by tapping the SMS icon or whether they must use BlackBerry Dynamics SMS apps. Specify whether to allow access to the user's native browser or native map app. Specify whether to enable two-factor authentication integration with a third-party RSA SecurID app using a CTF token seed. Note: BlackBerry Work supports CTF-based and file-based provisioning using BlackBerry Access, as well as CTF-based provisioning using a nativersa SecurID app. For more information on configuring RSA soft-token authentication and provisioning the token seed record your organization sends to users, see the BlackBerry Access Administration Guide. Allow 3rd Party App to Send Mail File Transfer Privileges Skype for Business Specify whether messages can be sent using mailto:/gmmmailto:/gwmailto Specify whether to allow the transfer of files to third-party native apps on the user's device. You can allow and disallow specific apps by app ID. If you are currently using Skype for Business 2015 or later in your environment, you can allow users to add meetings and join meetings directly from their calendars. 14

15 Interoperability Select the Allow to create Skype For Business meetings in calendar option to allow users to add Skype for Business meetings to their calendars. Select the Allow launching into Skype for Business app on mobile option to allow users to make voice and video calls and to be able to join Skype for Business meetings directly from a calendar invitation. The meeting is automatically opened in the Skype for Business client and users must have the Skype for Business client installed on their devices. In the Domain of Skype For Business meeting link field, enter the fully qualified domain name of the Skype for Business meeting links to allow internal users to use the Join meeting button in event details. Docs and Attachments tab Docs Repository Sending Attachments Receiving/Opening Attachments Specify whether to enable a file repository on the device, local or server docs repositories, and Box, and whether to force users to save pending uploads. Note: By default users are alerted about any pending uploads every 24 hours. If Forced Pending Uploads Policy is selected, users are blocked from taking any document related actions in BlackBerry Work until all files are successfully uploaded to the server. Specify whether to allow outgoing attachments and specify the maximum size and the file extensions that are allowed or disallowed. Specify whether to allow incoming attachments and specify a maximum size and the file extensions that are allowed or disallowed. Classification tab classification Specify whether to enable classification markings, such as INTERNAL, CONFIDENTIAL, NO FORWARD, and/or NO REPLY. To edit the XML classes, highlight and delete the code that you want to remove. Basic Configuration tab Security Settings Select Disable SSL Certificate Checking to disable SSL certificate verification for ActiveSync/Microsoft Exchange Web Services in test and POC environments. Select Expect Kerberos Constrained Delegation and supress username/password entry for Exchange to specify whether Kerberos Constrained Delegation will be used 15

16 Basic Configuration tab for logging in to Microsoft Exchange. If this option is not selected, NTLM/Basic authentication will be used. Select Clients must have individual login certificates (SSL) uploaded in the GC to specify whether clients must have individual login certificates (SSL) uploaded to the BlackBerry UEM management console. These certificates are used for login instead of basic credentials (username/password). Enterprise Server Settings In the Server List Reshuffle Period (minutes) field, specify the frequency that the server list, if present, is reshuffled for load balancing purposes. In the Server List Quarantine Period (minutes) field, specify how long BlackBerry Work waits before retrying if BlackBerry UEM is not working. Client Settings In the Sync Body Size (Kb) field, specify the size, in KB, of the partial message body downloaded from the server if the user selects the option to download partial message content. Select the Use BEMS to perform AutoDiscover of the EAS/EWS endpoint for the user option to specify that the client will use the BlackBerry Server Autodiscover service to determine the EAS/EWS endpoint for the user. Select the Create and consume rights-managed messages option to specify that IRM must be enabled for user mailboxes on Microsoft Exchange. Other Settings In the Send Feedback Address field, specify the address where client feedback messages are sent. Add multiple comma delimited recipients as needed. In the Report Phishing Address field, specify whether users can report s as phishing. The reported s are forwarded to the address provided in this field then moved to Trash folder. Account Setup ActiveSync and Auto Discover Authentication Methods (ios Only) Exchange Web Services Authentication Methods (ios Only) When Skip Short Form Setup Active Directory is selected, users must input their Microsoft Active Directory usernames, passwords, and domains during device activation. Specify the authentication methods to use. If only certain authentication methods are supported from Microsoft Exchange, set those values to minimize the user setup time. (For example, if Auto Discover and ActiveSync IIS Auth Settings are set to allow only NTLM and Basic, then de-select Negotiate in above app setting.) If none are selected, the default Microsoft Exchange setting is used. Specify the authentication methods to use. If only certain authentication methods are supported from Microsoft Exchange, set those values to minimize the user 16

17 Basic Configuration tab setup time. (For example, if EWS IIS Auth Setting is set to allow only NTLM, then select only NTLM above for an optimal setup experience.) If none are selected above, the default Microsoft Exchange setting is used. Exchange Web Services Settings Exchange ActiveSync Settings Specify the Microsoft Exchange Web Services URL endpoint (for example, mydomain.com/ews/exchange.asmx). In the Default Domain field, specify the Windows NT Domain to try automatically when logging in. If your server uses newer UPN style login instead of the older (domain\user) style login, this field should be left blank. In the ActiveSync Server field, specify the default Microsoft Exchange Server to connect to (for example, cas.mydomain.com). In the Autodiscover URL field, specify the auto discover URL if known. This speeds up the auto discover setup process (for example, autodiscover.mydomain.com). In the Autodiscover Connection Timeout in Seconds (ios only) field, specify the timeout setting for ios devices. Advanced Settings Specify additional configuration parameters in this text area. Contact BlackBerry Support for more details. Advanced Settings tab ActiveSync User Name Formats (ios Only) Select the username formats that can be used to authenticate with your Exchange ActiveSync server. To simplify user setup time, select only the username formats that are supported by yourexchange ActiveSync server. If you do not select an option, all options are allowed. Exchange Web Services User Name Formats (ios Only) Select the username formats that can be used to authenticate with Microsoft Exchange Web Services. To simplify user setup, select only the username formats that are supported by Microsoft Exchange Web Services. If you do not select an option, all options are allowed. Exchange TLS Certificate Settings Specify the user credential profile that contains the TLS certificate to be used to connect to Microsoft Exchange. The name of the profile that you specify here must match the name of the user credential profile that was created in the BlackBerry UEM management console. 17

18 Advanced Settings tab For more information on user credential profiles, see Using user credential profiles to send certificates to devices. Sync Window Exchange ActiveSync 16.0 Protocol (BETA) Office 365 Settings (BETA) Specify the number of days in the past to synchronize messages to devices. If the setting on a device allows for more days than the server setting, the server setting is used and messages that are older than the server setting are removed from the device. If the setting on the device allows fewer days than the server setting, the setting on the device remains the same. The user can change the setting on the device to fewer days than the server setting. If supported by your Microsoft Exchange server, specify whether to use Exchange ActiveSync version 16 for synchronization between Microsoft Exchange and BlackBerry Dynamics apps. If you change this setting, all data is resynchronized. Select the Use Office 365 Settings option to configure options for Microsoft Office 365. If selected, specify the following: Select the Use Office 365 Modern Authentication option to use modern authentication instead of basic authentication. Modern authentication enables BlackBerry Work to use sign-in features such as Multi-Factor Authentication, SAML-based third-party Identity Providers, and smart card and certificate-based authentication. In the Office 365 Sign On URL field, specify the web address that BlackBerry Work should use when signing in to Office 365. If you do not specify a value, BlackBerry Work will use login.microsoftonline.com during setup. In the Office 365 Tenant ID field, specify the tenant ID of Office 365 server that you want BlackBerry Work to connect to during setup. If you do not specify a value, a value of "common" is used. In the Azure App ID field, specify the Microsoft Azure app ID for BlackBerry Work. For information on how obtain an Azure ID, see Obtain an Azure app ID for BlackBerry Work. Performance Reporting tab Enable Performance Reporting HTTP Connection Error Specify whether to monitor performance of the BlackBerry Work app. Specify whether to report HTTP connection errors between BlackBerry Work and the specified application servers. 18

19 Performance Reporting tab HTTP Response Time HTTP Status Code Don't send reports for duration (in seconds) Specify whether to report HTTP responses that are taking longer than the specified time. Enter the application server addresses to monitor. Specify whether to report a specified HTTP status code. Enter the application server addresses to monitor. Specify the amount of time to wait before sending another report. Obtain an Azure app ID for BlackBerry Work 1. Log on to portal.azure.com. 2. In the left column, click Azure Active Directory. 3. Click App registrations. 4. Click New application registration. 5. In the Name field, enter a name for the application. 6. In the Application type drop-down list, select Native. 7. In the Redirect URI field, enter com.blackberry.work://connect/o365/redirect. 8. Click Create. 9. Select the application name that you created. 10. Click Required permissions. 11. Click Add. 12. Click Select an API 13. Select Office 365 Exchange Online (Microsoft Exchange). 14. Set the permission for Microsoft Office Add another permission for Microsoft Graph and apply the following permissions: Application Permissions Delegated Permissions 19

20 Configure BlackBerry Work connection settings When you configure your environment for BlackBerry Work, you must add the necessary Exchange ActiveSync servers and BlackBerry Enterprise Mobility Server instances to the connectivity profiles that you have assigned to users that will install BlackBerry Work. 1. On the menu bar, click Policies and Profiles. 2. Click beside Connectivity (BlackBerry Dynamics) to create a new connectivity profile or click on the Default connectivity profile to edit it. 3. In the Additional servers section, click. 4. In the Server field, specify the FQDN of the Exchange ActiveSync server. 5. In the Port field, specify the port for the Exchange ActiveSync server. By default, the port number is In the Primary BlackBerry Proxy cluster drop-down list, specify the name of the BlackBerry Proxy cluster that you want to set as the primary cluster. 7. In the Secondary BlackBerry Proxy cluster drop-down list, specify the name of the BlackBerry Proxy cluster that you want to set as the secondary cluster. 8. Click Save. 9. In the Additional servers section, click. 10. In the Server field, specify the FQDN of the BlackBerry Enterprise Mobility Server. 11. In the Port field, specify the port for the BlackBerry Enterprise Mobility Server. By default, the port number is 8080 or In the Primary BlackBerry Proxy cluster drop-down list, specify the name of the BlackBerry Proxy cluster that you want to set as the primary cluster. 13. In the Secondary BlackBerry Proxy cluster drop-down list, specify the name of the BlackBerry Proxy cluster that you want to set as the secondary cluster. 14. Click Save. 15. In the App servers section, click Add. 16. Search for and select BlackBerry Work. 17. Click Save. 18. In the table for the app, click. 19. In the Server field, specify the FQDN of the BlackBerry Enterprise Mobility Server. 20. In the Port field, specify the port of the BlackBerry Proxy cluster that is used to access the BlackBerry Enterprise Mobility Server. 20

21 21. In the Priority drop-down list, specify the priority of the BlackBerry Proxy cluster that must be used to reach the domain. 22. In the Primary BlackBerry Proxy cluster drop-down list, specify the name of the BlackBerry Proxy cluster that you want to set as the primary cluster. 23. In the Secondary BlackBerry Proxy cluster drop-down list, specify the name of the BlackBerry Proxy cluster that you want to set as the secondary cluster. 24. Click Save. 25. Click Add or Save. Creating and managing user groups A user group is a collection of related users who share common properties. Administering users as a group is more efficient than administering individual users because properties can be added, changed, or removed for all members of the group at the same time. Users can belong to more than one group at a time. You can assign an IT policy, profiles, and apps in the management console when you create or update the settings for a user group. If the BlackBerry UEM domain supports BlackBerry OS (version 5.0 to 7.1) devices, you can also assign a BlackBerry OS IT policy, profiles, and software configurations. You can create two types of user groups: Directory-linked groups link to groups in your company directory. Only directory user accounts can be members of a directory-linked group. Local groups are created and maintained in BlackBerry UEM and can have local user accounts and directory user accounts assigned to them. After you create user groups, you can define a group as a member of another group. When you nest a group within a user group, members of the nested group inherit the properties of the user group. You create and maintain the nesting structure in BlackBerry UEM and you can nest both directory-linked groups and local groups within each type of user group. Creating directory-linked groups You can create groups in BlackBerry UEM that are linked to one or more groups in your company directory. These BlackBerry UEM groups are called "directory-linked groups." Only directory user accounts can be members of a directory-linked group. At a scheduled interval, BlackBerry UEM automatically synchronizes the membership of a directory-linked group with its associated company directory group (or groups). Users that were added or removed from the company directory group are added or removed from the directory-linked group. Note: When users are moved into a company directory group that is linked to a directory-linked group, they are assigned the policies, profiles, and apps that are assigned to the group. When users are removed from a company directory group that is linked to a directory-linked group, the policies, profiles, and app are removed from the user. 21

22 Each directory-linked group can link to only a single company directory. For example, if BlackBerry UEM has two Microsoft Active Directory connections (A and B), and you create a directory-linked group that is linked to connection A, you can link only to directory groups from connection A. You must create new directory linked groups for any other directory connections. To enable this feature, see "Enable directory-linked groups" in the Configuration content. Synchronizing directory-linked groups does not add or delete users in BlackBerry UEM. To allow BlackBerry UEM to create user accounts when new company directory users are created, you must enable and configure onboarding. For more information, see "Enabling onboarding" in the Configuration content.. Create a directory-linked group Before you begin: Enable directory-linked groups. For instructions, see the Configuration content. 1. On the menu bar, click Groups. 2. Click. 3. Type the group name. 4. In the Linked directory groups section, perform the following actions: a. Click. b. Type the name or partial name of the company directory group you want to link to. c. If you have more than one company directory connection, select the connection that you want to search. After you have made this selection, the directory-linked group is permanently associated with the selected connection. d. Click. e. Select the company directory group in the search results list. f. Click Add. The company directory group displays in the list and the company directory connection the group is linked to displays beside the section title. g. If necessary, select the Link nested groups check box. You can leave the check box unselected to link to all nested groups, or you can select the check box to allow the directory settings to control the number of nested groups. h. Repeat these steps to link additional groups. 5. To assign a user role to the directory-linked group, perform the following actions: a. In the User role section, click b. In the drop-down list, click the name of the user role that you want to assign to the group. c. Click Add. 6. To assign an IT policy or profile to the directory-linked group, perform the following actions: a. In the IT policy and profiles section, click. b. Click IT policy or a profile type. 22

23 c. In the drop-down list, click the name of the IT policy or profile that you want to assign to the group. d. Click Assign. 7. To assign an app to the directory-linked group, in the Assigned apps section, click. 8. Search for the app. 9. In the search results, select the app. 10. Click Next. 11. In the Disposition drop-down list for the app, perform one of the following actions: To install the app automatically on devices, and to prevent users from removing the app, select Required. This option is not available for BlackBerry apps. To permit users to install and remove the app, select Optional. 12. For ios devices, to assign per-app VPN settings to an app or app group, in the Per app VPN drop-down list for the app or app group, select the settings to associate with the app or app group. 13. Click Assign. 14. Click Add. Add a company directory group to an existing directory-linked group 1. On the menu bar, click Groups. 2. Click the directory-linked group. 3. Click the Settings tab. 4. Click. 5. In the Linked directory groups section, click. 6. Type the company directory group name. 7. Click Search. 8. Select the company directory group in the search results list. 9. Click Add. 10. If required, select Link nested groups. Create a local group 1. On the menu bar, click Groups. 2. Click. 23

24 3. Type a name for the user group. 4. Optionally, type a description for the user group. 5. To assign a user role to the local group, perform the following actions: a. In the User role section, click. b. In the drop-down list, click the name of the user role that you want to assign to the group. c. Click Add. 6. To assign an IT policy or profile to the local group, perform the following actions: a. In the IT policy and profiles section, click. b. Click IT policy or a profile type. c. In the drop-down list, click the name of the IT policy or profile that you want to assign to the group. d. Click Assign. 7. To assign an app to the user group, in the Assigned apps section, click. 8. Search for the app. 9. In the search results, select the app. 10. Click Next. 11. In the Disposition drop-down list for the app, perform one of the following actions: To install the app automatically on devices, and to prevent users from removing the app, select Required. This option is not available for BlackBerry apps. To permit users to install and remove the app, select Optional. Note: If the same app is assigned to a user account and to the user group that the user belongs to, the disposition of the app assigned to the user account takes precedence. 12. For ios devices, to assign per-app VPN settings to an app or app group, in the Per app VPN drop-down list for the app or app group, select the settings to associate with the app or app group. 13. Click Assign. 14. When you are finished specifying the user group properties, click Add. 24

25 Assign the BlackBerry Dynamics profile to a user group Before you begin: Create a BlackBerry Dynamics profile. 1. On the menu bar, click Groups. 2. Search for a user group. 3. In the search results, click the name of the user group. 4. In the IT policy and profiles section, click. 5. Click BlackBerry Dynamics. 6. In the drop-down list, click the name of the profile that you want to assign to the group. 7. If a BlackBerry Dynamics profile is already assigned directly to the group, click Replace. Otherwise, click Assign. Assign an app to a user group When you assign apps to a user group, the apps are made available to any applicable devices that the members of the user group have activated. You can also assign apps to user groups for device types that the members of the user group have not activated yet. This makes sure that if any member of the group activates a different device type in the future, the proper apps are made available to new devices. If a user account is a member of multiple user groups that have the same apps or app groups assigned to them, only one instance of the app or app group appears in the list of assigned apps for that user account. The same app can be assigned directly to the user account, or inherited from user groups or device groups. The settings for the app (for example, whether the app is required) are assigned based on priority. Device groups have the highest priority, then user accounts, then user groups. Before you begin: Add the app to the available app list. Optionally, add the apps to an app group. 1. On the menu bar, click Groups. 2. On the User groups tab, click the name of a group. 3. On the Managed devices tab, in the Assigned apps section, click. 4. In the search field, type the app name, vendor, or URL of the app that you want to add. 5. Select the check box beside the apps or app group that you want to assign to the user group. 6. Click Next. 25

26 7. In the Disposition drop-down list for the app, perform one of the following actions: To require users to install the app, select Required. To permit users to install and remove the app, select Optional. Note: If the same app is assigned to a user account, a user group that the user belongs to, and the device group the device belongs to, the disposition of the app assigned in the device group takes precedence. 8. For ios devices, to assign per-app VPN settings to an app or app group, in the Per app VPN drop-down list for the app or app group, select the settings to associate with the app or app group. 9. For ios and Android devices, if there is an available app configuration, select the app configuration to assign to the app. 10. Perform one of the following tasks: Task If you have not added a VPP account or you are not adding an ios app If you are adding an ios app and you have added at least one VPP account Steps 1. Click Assign. 1. Click Next. 2. Select Yes if you want to assign a license to the ios app. Select No, if you do not want to assign a license or you do not have a license to assign to the app. 3. If you have assigned a license to the app, in the App license drop-down list, select the VPP account to associate with the app. 4. In the Assign license to drop-down list, assign the license to the User or Device. If no value is specified in the App license drop-down list, the Assign license to drop-down list is not available. 5. Click Assign. Users must follow the instructions to enroll in your organization's VPP on their devices before they can install prepaid apps. Users have to complete this task once. Note: If you grant access to more licenses than you have available, the first users who access the available licenses can install the app. If the app is a required app that does not have an available license, you must obtain the license before the user can install the app or the user will be subject to any compliance rules that you have assigned to the user. Connect Good Mobile Control to BlackBerry UEM You can import users from Good Mobile Control to BlackBerry UEM and assign them to a user group in BlackBerry UEM. Before you begin: 26

27 If you are migrating Microsoft Active Directory users, you must connect BlackBerry UEM to the same Active Directory instance that you are using with Good Mobile Control. 1. In Good Mobile Control, click Settings > Enterprise Servers. 2. Click Add. 3. In the URL field, type the WSDL URL of the BlackBerry UEM console that you want to connect to and enter the log in credentials for the BlackBerry UEM administrator account that you want to use. The WSDL URL is the host name and port number For example, 4. Select the Enable automatic import of users in BlackBerry UEM option, if you want to allow users to be automatically added to BlackBerry UEM. When this option is selected, users are imported into BlackBerry UEM when they activate their first BlackBerry Dynamics app. 5. Select the user group to add the user to in BlackBerry UEM. Make sure that you select a user group that has the BlackBerry Work app assigned to it. Steps to migrate users Step Action In the Good for Enterprise client, turn off Contact Sync. On ios devices, remove the MDM profile. Instruct users to migrate from Good for Enterprise to BlackBerry Work. In BlackBerry Work, turn on Contact Sync. Remove the GFE MDM profile on ios devices Because ios devices can only have one MDM profile installed, users with MDM managed ios devices must remove the GFE MDM Profile. Users must complete the following steps to remove the profile: 1. Tap Settings > General > Profiles & Device Management. 2. In the Mobile Device Management section, tap GFE MDM Profile. 3. Tap Remove Management. 27

28 Migrate from Good for Enterprise to BlackBerry Work You can send the following instructions to users that are migrating from Good for Enterprise to BlackBerry Work. 1. Open the BlackBerry Work app. 2. Tap Set up using Good for Enterprise - Auth Delegate. 3. On the Work is requesting setup screen, click OK. Wait while the app is activated. 4. When you are prompted, create a password for BlackBerry Work. 5. Tap I agree to accept the license agreement. 6. Enter the login credentials for your account. 7. Tap Next. Wait while the account information is synchronized. 8. When you are prompted, tap the BlackBerry Dynamics Launcher icon. The BlackBerry Work app synchronizes your messages. Decommissioning Good for Enterprise Good for Enterprise and BlackBerry Work can co-exist on the same device. Depending on your organization s mobile device policies, you can allow a transition period for users to become familiar with BlackBerry Work while they still have access to their and calendar from Good for Enterprise. You can eventually end the transition period using one of the following approaches. Hard cutoff: You schedule a concrete cutoff date after which cannot access Good for Enterprise. The hard cutoff date is applied and enforced using the Wipe Container option in Good Mobile Control. Notify your users of the impending change through any standard communication channel that your organization uses. Immediately after the cutoff date, users must use BlackBerry Work to access the functionality previously provided by Good for Enterprise. Another option is to modify the policy for end users to make BlackBerry Work the authentication delegate. When the change goes into effect, users cannot use Good for Enterprise without downloading and provisioning BlackBerry Work. When users download and activate BlackBerry Work, they are prompted to create a new password for the new app, where Good for Enterprise and every other BlackBerry Dynamics app will use BlackBerry Work as the authentication delegate. Soft cutoff: You let your end users choose when to move to the new platform. You provision them in advance to use BlackBerry Work after you create a compliance policy in Good Mobile Control to wipe Good for Enterprise when that device has not connected to the NOC after a set number of days. User entitlement to Good for Enterprise is then removed from the device. The Good for Enterprise app will still need to be uninstalled by the user. In both cases hard cutoff or soft cutoff you can monitor the adoption of BlackBerry Work and the lack of Good for Enterprise usage in the various reports available in Good Mobile Control. For information on how to create and view reports, see the Good Mobile Messaging Administrator's Guide. You can then proactively remove Good for Enterprise from your users' devices or wait for the migration to happen organically. 28